From 1d0ba9a61f0bc30209a8eae48b863241044b6b23 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Tue, 17 Sep 2013 17:55:43 -0400 Subject: Stop sending the current time in client NETINFO handshakes. Implements part of proposal 222. --- changes/no_client_timestamps_024 | 5 +++++ src/or/connection_or.c | 5 +++-- 2 files changed, 8 insertions(+), 2 deletions(-) create mode 100644 changes/no_client_timestamps_024 diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 new file mode 100644 index 0000000000..6df530743d --- /dev/null +++ b/changes/no_client_timestamps_024 @@ -0,0 +1,5 @@ + o Minor features (security): + - Clients no longer send timestamps in their NETINFO cells. These were + not used for anything, and they provided one small way for clients + to be distinguished from each other as they moved from network to + network or behind NAT. diff --git a/src/or/connection_or.c b/src/or/connection_or.c index d5dd4470e3..95cb39ac89 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -2051,8 +2051,9 @@ connection_or_send_netinfo(or_connection_t *conn) memset(&cell, 0, sizeof(cell_t)); cell.command = CELL_NETINFO; - /* Timestamp. */ - set_uint32(cell.payload, htonl((uint32_t)now)); + /* Timestamp, if we're a relay. */ + if (! conn->handshake_state->started_here) + set_uint32(cell.payload, htonl((uint32_t)now)); /* Their address. */ out = cell.payload + 4; -- cgit v1.2.3-54-g00ecf From f8b44eedf725cadb15c3a0ad1bc5a0fa1dbbc21d Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Tue, 17 Sep 2013 18:05:48 -0400 Subject: Get ready to stop sending timestamps in INTRODUCE cells For now, round down to the nearest 10 minutes. Later, eliminate entirely by setting a consensus parameter. (This rounding is safe because, in 0.2.2, where the timestamp mattered, REND_REPLAY_TIME_INTERVAL was a nice generous 60 minutes.) --- changes/no_client_timestamps_024 | 9 +++++++-- doc/tor.1.txt | 9 +++++++++ src/or/config.c | 1 + src/or/or.h | 3 +++ src/or/rendclient.c | 20 +++++++++++++++++++- 5 files changed, 39 insertions(+), 3 deletions(-) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index 6df530743d..fe8f419273 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -1,5 +1,10 @@ - o Minor features (security): + o Minor features (security, timestamp avoidance, proposal 222): - Clients no longer send timestamps in their NETINFO cells. These were not used for anything, and they provided one small way for clients to be distinguished from each other as they moved from network to - network or behind NAT. + network or behind NAT. Implements part of proposal 222. + - Clients now round timestamps in INTRODUCE2 cells to the nearest + 10 minutes. If a new Support022HiddenServices option is set to 0, + or if it's set to "auto" and the feature is disabled in the consensus, + the timestamp is sent as 0 instead. + diff --git a/doc/tor.1.txt b/doc/tor.1.txt index d53ff2e695..ff760d41ab 100644 --- a/doc/tor.1.txt +++ b/doc/tor.1.txt @@ -1338,6 +1338,15 @@ The following options are useful only for clients (that is, if Tor will use a default value chosen by the directory authorities. (Default: -1.) +**Support022HiddenServices** **0**|**1**|**auto**:: + Tor hidden services running versions before 0.2.3.x required clients to + send timestamps, which can potentially be used to distinguish clients + whose view of the current time is skewed. If this option is set to 0, we + do not send this timestamp, and hidden services on obsolete Tor versions + will not work. If this option is set to 1, we send the timestamp. If + this optoin is "auto", we take a recommendation from the latest consensus + document. (Default: auto) + SERVER OPTIONS -------------- diff --git a/src/or/config.c b/src/or/config.c index 4e08f3c3a5..18f1c29501 100644 --- a/src/or/config.c +++ b/src/or/config.c @@ -388,6 +388,7 @@ static config_var_t option_vars_[] = { V(SSLKeyLifetime, INTERVAL, "0"), OBSOLETE("StatusFetchPeriod"), V(StrictNodes, BOOL, "0"), + V(Support022HiddenServices, AUTOBOOL, "auto"), OBSOLETE("SysLog"), V(TestSocks, BOOL, "0"), OBSOLETE("TestVia"), diff --git a/src/or/or.h b/src/or/or.h index 8c6c1e3635..eff5a6d2b4 100644 --- a/src/or/or.h +++ b/src/or/or.h @@ -4099,6 +4099,9 @@ typedef struct { /** How long (seconds) do we keep a guard before picking a new one? */ int GuardLifetime; + + /** Should we send the timestamps that pre-023 hidden services want? */ + int Support022HiddenServices; } or_options_t; /** Persistent state for an onion router, as saved to disk. */ diff --git a/src/or/rendclient.c b/src/or/rendclient.c index 7115bf2080..9d48b9ce99 100644 --- a/src/or/rendclient.c +++ b/src/or/rendclient.c @@ -16,6 +16,7 @@ #include "connection_edge.h" #include "directory.h" #include "main.h" +#include "networkstatus.h" #include "nodelist.h" #include "relay.h" #include "rendclient.h" @@ -127,6 +128,16 @@ rend_client_reextend_intro_circuit(origin_circuit_t *circ) return result; } +/** Return true iff we should send timestamps in our INTRODUCE1 cells */ +static int +rend_client_should_send_timestamp(void) +{ + if (get_options()->Support022HiddenServices >= 0) + return get_options()->Support022HiddenServices; + + return networkstatus_get_param(NULL, "Support022HiddenServices", 1, 0, 1); +} + /** Called when we're trying to connect an ap conn; sends an INTRODUCE1 cell * down introcirc if possible. */ @@ -238,7 +249,14 @@ rend_client_send_introduction(origin_circuit_t *introcirc, REND_DESC_COOKIE_LEN); v3_shift += 2+REND_DESC_COOKIE_LEN; } - set_uint32(tmp+v3_shift+1, htonl((uint32_t)time(NULL))); + if (rend_client_should_send_timestamp()) { + time_t now = (uint32_t)time(NULL); + now += 300; + now -= now % 600; + set_uint32(tmp+v3_shift+1, htonl(now)); + } else { + set_uint32(tmp+v3_shift+1, 0); + } v3_shift += 4; } /* if version 2 only write version number */ else if (entry->parsed->protocols & (1<<2)) { -- cgit v1.2.3-54-g00ecf From accadd8752bb26efeb31a5c866a16cc863963893 Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Wed, 18 Sep 2013 10:51:04 -0400 Subject: Remove the timestamp from AUTHENTICATE cells; replace with random bytes This isn't actually much of an issue, since only relays send AUTHENTICATE cells, but while we're removing timestamps, we might as well do this too. Part of proposal 222. I didn't take the approach in the proposal of using a time-based HMAC, since that was a bad-prng-mitigation hack from SSL3, and in real life, if you don't have a good RNG, you're hopeless as a Tor server. --- changes/no_client_timestamps_024 | 8 +++++--- src/or/connection_or.c | 18 +++++------------- 2 files changed, 10 insertions(+), 16 deletions(-) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index fe8f419273..9ded8b3d9f 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -3,8 +3,10 @@ not used for anything, and they provided one small way for clients to be distinguished from each other as they moved from network to network or behind NAT. Implements part of proposal 222. - - Clients now round timestamps in INTRODUCE2 cells to the nearest + - Clients now round timestamps in INTRODUCE2 cells down to the nearest 10 minutes. If a new Support022HiddenServices option is set to 0, or if it's set to "auto" and the feature is disabled in the consensus, - the timestamp is sent as 0 instead. - + the timestamp is sent as 0 instead. Implements part of proposal 222. + - Stop sending timestamps in AUTHENTICATE cells. This is not such + a big deal from a security point of view, but it achieves no actual + good purpose, and isn't needed. Implements part of proposal 222. diff --git a/src/or/connection_or.c b/src/or/connection_or.c index 95cb39ac89..39a5317cfd 100644 --- a/src/or/connection_or.c +++ b/src/or/connection_or.c @@ -2287,19 +2287,11 @@ connection_or_compute_authenticate_cell_body(or_connection_t *conn, if (server) return V3_AUTH_FIXED_PART_LEN; // ptr-out - /* Time: 8 octets. */ - { - uint64_t now = time(NULL); - if ((time_t)now < 0) - return -1; - set_uint32(ptr, htonl((uint32_t)(now>>32))); - set_uint32(ptr+4, htonl((uint32_t)now)); - ptr += 8; - } - - /* Nonce: 16 octets. */ - crypto_rand((char*)ptr, 16); - ptr += 16; + /* 8 octets were reserved for the current time, but we're trying to get out + * of the habit of sending time around willynilly. Fortunately, nothing + * checks it. That's followed by 16 bytes of nonce. */ + crypto_rand((char*)ptr, 24); + ptr += 24; tor_assert(ptr - out == V3_AUTH_BODY_LEN); -- cgit v1.2.3-54-g00ecf From fd2954d06d2e9b8b0d33bcd0a2e3dfb947ff662e Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Wed, 18 Sep 2013 11:09:34 -0400 Subject: Round down hidden service descriptor publication times to nearest hour Implements part of proposal 222. We can do this safely, since REND_CACHE_MAX_SKEW is 24 hours. --- changes/no_client_timestamps_024 | 2 ++ src/or/rendservice.c | 1 + 2 files changed, 3 insertions(+) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index 9ded8b3d9f..488630fb36 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -10,3 +10,5 @@ - Stop sending timestamps in AUTHENTICATE cells. This is not such a big deal from a security point of view, but it achieves no actual good purpose, and isn't needed. Implements part of proposal 222. + - Reduce down accuracy of timestamps in hidden service descriptors. + Implements part of proposal 222. diff --git a/src/or/rendservice.c b/src/or/rendservice.c index 00bca17d46..8a4a11e475 100644 --- a/src/or/rendservice.c +++ b/src/or/rendservice.c @@ -593,6 +593,7 @@ rend_service_update_descriptor(rend_service_t *service) d = service->desc = tor_malloc_zero(sizeof(rend_service_descriptor_t)); d->pk = crypto_pk_dup_key(service->private_key); d->timestamp = time(NULL); + d->timestamp -= d->timestamp % 3600; /* Round down to nearest hour */ d->intro_nodes = smartlist_new(); /* Support intro protocols 2 and 3. */ d->protocols = (1 << 2) + (1 << 3); -- cgit v1.2.3-54-g00ecf From 39bb59d36322f3092bcb8c80c54ce4930dddef3a Mon Sep 17 00:00:00 2001 From: Nick Mathewson Date: Fri, 20 Sep 2013 11:00:04 -0400 Subject: Avoid error by not saying which intro cell type I mean --- changes/no_client_timestamps_024 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/changes/no_client_timestamps_024 b/changes/no_client_timestamps_024 index 488630fb36..41dea2f1a6 100644 --- a/changes/no_client_timestamps_024 +++ b/changes/no_client_timestamps_024 @@ -3,7 +3,7 @@ not used for anything, and they provided one small way for clients to be distinguished from each other as they moved from network to network or behind NAT. Implements part of proposal 222. - - Clients now round timestamps in INTRODUCE2 cells down to the nearest + - Clients now round timestamps in INTRODUCE cells down to the nearest 10 minutes. If a new Support022HiddenServices option is set to 0, or if it's set to "auto" and the feature is disabled in the consensus, the timestamp is sent as 0 instead. Implements part of proposal 222. -- cgit v1.2.3-54-g00ecf